Wireshark-bugs: [Wireshark-bugs] [Bug 5718] IPP : malformed packages
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 24 Feb 2011 07:48:16 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5718

--- Comment #2 from Bill Meier <wmeier@xxxxxxxxxxx> 2011-02-24 10:48:14 EST ---
After looking at the capture:

1. The traffic sure doesn't look anything like IPP even though the TCP
connection begins with a connect to port 631 ("IPP"). 

IOW: I'm pretty convinced the traffic isn't IPP.

2. The preponderance of the traffic goes *from* 192.168.1.50 port 631 *to*
   192.60.0.253 port 33496.

3. FWIW: I see references to "UML" i the initial handshake packets.


I've no idea what the traffic actually is.

If I had to guess, I'd wonder if the capture is the actual print stream going
to the shared printer.

Might 192.60.0.253 be your shared laser printer ?

In any case:
It seems to me that this is a case of TCP port 631 (IPP) being used for
something other than IPP with Wireshark trying to dissect the traffic as IPP
and unable to do so.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.